Overview

overview

10

Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3060-4-0x0000000002B20000-0x0000000002B9E000-memory.dmp

  • Size

    504KB

  • Sample

    240503-lgwyeadf34

  • MD5

    2a8739a3c26dea2035affd9e5a8c653c

  • SHA1

    ed3f31f705b06c37855ec26adb312d4a720f885d

  • SHA256

    91c7dd0daf2aa3978fbaf99ae5ce7aa4c70fec9e2e8db65691394b5578f0c028

  • SHA512

    4719ef3983df5dc5e1c2e956f84e62b05637aeb0e0fe3d73c27919d41ae68176894086827bb83fa030c959f33671d721f25c37debbff02d33e0e3f05426ab9c2

  • SSDEEP

    3072:8AgWGmZmxfXkahUGIGo7viEXFCoOesCmL2J7ubUZjtUoQ2:7gbfXh4KEXFCoOc7ub0jL

Score
10/10
cobaltstrike100000000

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

C2

http://207.148.109.8:443/ptj

Attributes
  • access_type

    512

  • beacon_type

    2048

  • host

    207.148.109.8,/ptj

  • http_header1

    AAAACgAAAF1BY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCwqLyo7cT0wLjgAAAAKAAAATEFjY2VwdC1MYW5ndWFnZTogemgtQ04semg7cT0wLjgsemgtVFc7cT0wLjcsemgtSEs7cT0wLjUsZW4tVVM7cT0wLjMsZW47cT0wLjIAAAAKAAAAXFVzZXItQWdlbnQ6IE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQ7IHJ2OjEwMi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEwMi4wAAAACgAAAB5BY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGRlZmxhdGUAAAAKAAAAGFNlYy1GZXRjaC1EZXN0OiBkb2N1bWVudAAAAAcAAAAAAAAADQAAAAUAAAACd2EAAAAJAAAADnBhdGg9L2NhbGVuZGFyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAoAAAALQWNjZXB0OiAqLyoAAAAHAAAAAQAAAA0AAAAFAAAAAndhAAAABwAAAAAAAAANAAAAAgAAAAZ3bGE0Mj0AAAACAAAAC3hpZD03MzBiZjc7AAAAAgAAABJNU1BBdXRoPTNFa0FqREtqSTsAAAACAAAAJU1TMD0xYWZkNGZiMzc5NzE0MzU3YTU5NTMyYTI0YmVmNTJiNDsAAAACAAAAK0VYUElEPTMwN2Y3ZWRkLWIwN2ItNGJkNC1iZThhLTE2ZmYyYTlhM2U0NzsAAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    10240

  • polling_time

    60000

  • port_number

    443

  • sc_process32

    %windir%\syswow64\dllhost.exe

  • sc_process64

    %windir%\sysnative\dllhost.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFmCVAqjwVXuM7g1vpo6ws7F+89TG0j5DCCRZfoZgIoX/jC+Up1bO/cQEM8vbtN5DBXbM/fGccz/PaIU+FnDwN1pCtQkzmF7yvQlPeTsKLNRPWe+HbkFdFgx01MKs9suqkR0K+kN25zEqFkboK0/TnaNbCV7dOLkfXXNiphNvoywIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    1.448416512e+09

  • unknown2

    AAAABAAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown3

    1.610612736e+09

  • uri

    /OWA/

  • user_agent

    Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.50

  • watermark

    100000000

Targets

    Tasks